CVE-2026-97635 in Agent Zero
Summary
by MITRE • 10/23/2026
The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads. When Agent Zero reproduces content in the chat interface, any injected JavaScript is executed in the context of the victim’s authenticated Agent Zero Web UI session.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in versions of Agent Zero prior to 1.15 represents a critical Cross-Site Scripting (XSS) flaw rooted in insufficient input validation and output encoding within the web application interface. This security defect allows attackers to inject malicious JavaScript code into chat messages or file uploads, which is then rendered without proper sanitization by the browser of an authenticated user. The core technical failure lies in the application's handling of dynamic content reproduction; rather than treating user-supplied data as plain text, the system processes it as executable script within the context of the victim’s active session. This lack of strict type enforcement and encoding means that any special characters or script tags embedded by an attacker are interpreted directly by the client-side environment, bypassing standard security controls designed to prevent code injection attacks.
From a technical perspective, this vulnerability aligns with CWE-79, which classifies improper neutralization of input during web page generation as a common cause of cross-site scripting flaws. The attack vector typically involves an adversary crafting a malicious payload disguised within a chat message or uploaded file content. When another user views the compromised data through the Agent Zero Web UI, their browser executes the injected script immediately upon rendering the response. This execution occurs in the security context of the authenticated session, granting the attacker elevated privileges equivalent to those of the victim user. The persistence of this state means that even if the initial injection is static, its effects can be long-lasting depending on how the application stores and retrieves chat history or file metadata for display purposes.
The operational impact of this vulnerability is severe due to the authenticated nature of the session context. An attacker who successfully exploits this flaw can perform a wide range of malicious actions that compromise both confidentiality and integrity. These include stealing sensitive session cookies, tokens, or authentication credentials stored in local storage or accessed via JavaScript APIs. Furthermore, the attacker could manipulate the user interface to phish for additional secrets, redirect users to malicious external sites, or execute arbitrary commands on behalf of the victim within the application's functional scope. In enterprise environments where Agent Zero might be integrated with other systems or used to process sensitive data, this breach can serve as a foothold for further lateral movement or data exfiltration, significantly escalating the risk profile beyond simple client-side disruption.
This vulnerability is also closely associated with MITRE ATT&CK technique T1059, specifically Command and Scripting Interpretation via JavaScript, which describes how attackers use scripting languages to execute commands within a victim's environment. The exploitation of this flaw allows for automated interaction with the application’s backend through AJAX requests initiated by the injected script, potentially leading to unauthorized data retrieval or modification without direct user awareness. To mitigate these risks, immediate action is required at both the development and deployment levels. Developers must implement strict input validation that rejects any non-essential characters in chat fields and file contents, ensuring only expected alphanumeric and standard punctuation are accepted. Additionally, output encoding must be applied consistently to all dynamic content before it is rendered in the DOM, utilizing context-aware escaping techniques appropriate for HTML bodies or attributes. Upgrading to version 1.15 or later resolves this issue by addressing these sanitization gaps. Until an upgrade can be performed, deploying a Web Application Firewall with rules capable of detecting and blocking script injection patterns may provide temporary protection against exploitation attempts.